If you’re given the option of selecting a verification method and are deciding which to use, we recommend considering the following questions for each process allowed by each vendor:
Data: What info does each method require?
Access: Who can see the data during the course of the verification process?
Retention: Who will hold onto that data after the verification process, and for how long?
Audits: How sure are we that the stated claims will happen in practice? For example, are there external audits confirming that data is not accidentally leaked to another site along the way? Ideally these will be in-depth, security-focused audits by specialized auditors like NCC Group or Trail of Bits, instead of audits that merely certify adherence to standards.
Visibility: Who will be aware that you’re attempting to verify your age, and will they know which platform you’re trying to verify for?
